Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-97402

Quick assessment

Affected
Eclipse Foundation Eclipse Kura
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Eclipse Kura 3.1.0 至 5.6.2 版本中，iBeacon 和 Eddystone 广播解码器错误地解析了空中 BLE 广播载荷中的 AD 结构长度字段。任何处于 BLE 无线电范围内的未认证攻击者均可广播一个双字节的广告载荷，导致 Kura 信标扫描线程陷入紧密的无限循环，从而占用一个 CPU 核心，并永久阻断信标数据的接收，直至网关重启。要触发此攻击，必须已安装并激活 iBeacon/Eddystone 扫描组件。默认情况下，这些组件并未安装或启用。

CVSS 2.3 · Low
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-97402

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In Eclipse Kura versions 3.1.0 to 5.6.2, the iBeacon and Eddystone advertisement decoders wrongly parse the AD-structure length field of an over-the-air BLE advertising payload. Any unauthenticated attacker within BLE radio range can broadcast a two-byte advertising payload that drives the Kura beacon-scanner thread into a tight infinite loop, pinning a CPU core and permanently halting beacon ingestion until the gateway is restarted. To trigger the attack, the iBeacon/Eddystone scanner component should be installed and active. By default the components are not installed or enabled.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
Source: CVE Program / CVE List V5
Vulnerability Type
不可达退出条件的循环(无限循环)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Eclipse Foundation Eclipse Kura 3.1.0 ~ 5.6.2 -

II. Public POCs for CVE-2026-97402

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-97402

请登录查看更多情报信息。

Other References for CVE-2026-97402 (3)

Same Patch Batch · Eclipse Foundation · 2026-11-10 · 5 CVEs total

CVE-2026-97891 8.8 HIGH Eclipse Kura 5.0.0-5.6.2 认证会话耗尽漏洞
CVE-2026-112191 8.6 HIGH Eclipse Kura 5.4.0-5.6.2 权限绕过漏洞
CVE-2026-113422 7.7 HIGH Eclipse Kura 5.0.0-5.6.2 Wire Graph 权限提升漏洞
CVE-2026-114359 7.0 HIGH Eclipse Kura 远程下载及上传无限制导致拒绝服务

IV. Related Vulnerabilities

Same product: Eclipse Kura
Same vendor: Eclipse Foundation
Same weakness: CWE-835